Yesterday, I accidentally removed an authenticator app from my phone. Fortunately, I have another copy of the app on a different device. It made me realize how easy it is to lock myself out of my accounts. Do you think it’s a good idea to create a Windows VM with an Android emulator on it and install copies of all my authenticator apps, this will not cause any security issues?
Just use a sane authenticator app that lets you export the keys, and backup those safely.
I’ve been using aegis which is available on F-Droid. Whenever I add a new “critical” account I make a backup of the data. That’s it.
I self host Vaultwarden and when adding the QR, I add it to my free account with LastPass Authenticator app at the same time. Both back up so if my phone dies, I don’t lose the 2fa.
You should be backing up your secrets to some type of app like Vaultwarden or KeePassXC.
And you shouldn’t need to VM host an android OS just to have a secondary means of authenticating. There are plenty of apps out there that support adding your secrets.
Vaultwarden, Bitwarden, KeePassXC, or hell, a Yubikey 5 device and then use Yubikey Authenticator.
why not consolidate your auth apps?
i use selfhosted vaultwarden (with backups ofc) for everything, except for vaultwarden, which is protected by authy . and authy can be backed up easily
Sane MFA apps explicitly disallow their data from being backed up. That would be a massive attack vector if it was possible.
Which is exceedingly dumb IMHO. Sure it would be a vector, but it’s a vector to something that should be an additional step to username and password. Idk, I use vaultwarden and find myself worrying less about “what if?”. I’m also enabling TOTP far more often now that I can easily add it to my phone and have it sync to other systems.
Use the aegis authenticator. Its opensource an you can setup periodic export of encryptrd 2fa vault. Then you can integrate it into your existing backup flow